IoT: AttachPolicy does not reflect in ListAttachedPolicies or ListPrincipalPolicies APIs

[akapti]

Description

LocalStack's IoT mock does not properly reflect policy attachments when using the target-based AttachPolicy API. After successfully calling AttachPolicy with a certificate ARN as the target, subsequent read-back operations return empty policy lists.

Environment

• LocalStack Version: 3.8.1-Pro
• AWS Service: IoT Core
• APIs Affected:
  • ListAttachedPolicies (target-based)
  • ListPrincipalPolicies (deprecated principal-based)

Expected Behavior

After calling:

AttachPolicyRequest request = new AttachPolicyRequest()
    .withTarget(certificateArn)
    .withPolicyName("my-policy");
awsIot.attachPolicy(request);

The attached policy should be returned by:

1. ListAttachedPolicies with target=certificateArn
2. ListPrincipalPolicies with principal=certificateArn (deprecated but should still work)

Actual Behavior

Both ListAttachedPolicies and ListPrincipalPolicies return empty policy lists immediately after a successful AttachPolicy call.

Working API

ListThingPrincipals correctly reflects certificate attachments:

ListThingPrincipalsResult result = awsIot.listThingPrincipals(
    new ListThingPrincipalsRequest().withThingName(thingName)
);
// Returns the attached certificate ARN correctly ✅

Reproduction Steps

// 1. Create a thing
CreateThingResult thing = awsIot.createThing(
    new CreateThingRequest().withThingName("test-device")
);

// 2. Create a certificate
CreateKeysAndCertificateResult cert = awsIot.createKeysAndCertificate(
    new CreateKeysAndCertificateRequest().setSetAsActive(true)
);

// 3. Attach policy to certificate (target-based)
awsIot.attachPolicy(new AttachPolicyRequest()
    .withTarget(cert.getCertificateArn())
    .withPolicyName("test-policy")
);

// 4. Try to list attached policies - FAILS ❌ (returns empty)
ListAttachedPoliciesResult policies = awsIot.listAttachedPolicies(
    new ListAttachedPoliciesRequest()
        .withTarget(cert.getCertificateArn())
);
System.out.println("Policies: " + policies.getPolicies()); 
// Expected: [test-policy], Actual: []

// 5. Try deprecated API - ALSO FAILS ❌ (returns empty)
ListPrincipalPoliciesResult principalPolicies = awsIot.listPrincipalPolicies(
    new ListPrincipalPoliciesRequest()
        .withPrincipal(cert.getCertificateArn())
);
System.out.println("Principal Policies: " + principalPolicies.getPolicies()); 
// Expected: [test-policy], Actual: []

Impact

This prevents integration tests from verifying that:

• Certificate rotation correctly inherits policies
• New certificates are properly configured with required policies
• Policy attachment workflows are functioning correctly

Workaround

Currently testing certificate attachments via ListThingPrincipals instead of policy verification, which only partially validates the certificate lifecycle.

Additional Context

This issue was discovered while implementing AWS IoT certificate download and rotation functionality in integration tests using LocalStack's IoT mock service.

Test Reference

From our integration test:

// LocalStack's IoT mock does not reflect AttachPolicy (target-based) in either
// read-back API — ListAttachedPolicies or the deprecated ListPrincipalPolicies 
// both return an empty policy list immediately after a successful AttachPolicy 
// call — so we can't assert which policy the new certificate inherited, only 
// that the rotation itself happened: ListThingPrincipals correctly reflects 
// the certificate attachment.

Related AWS Documentation

• AttachPolicy API
• ListAttachedPolicies API
• ListPrincipalPolicies API (deprecated)

---

[EddEcho]

Hi @akapti , thanks for the report! I reproduced it on our latest :dev build and passed it to engineering. I'll follow up here once the fix is out so you can try it on a recent :dev build.